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Claim 1 (Currently amended): A method for detecting spurious network traffic comprising: 

receiving a packet, the packet including data for transmission over a network; 

calculating a plurality of possible ports at which the packet may have been received using 
a source network address of the packet, wherein each of the plurality of possible 
ports has associated therewith a weight, the weight relating to a likelihood that the 
packet would be received at the associated port; 

determining an e xp e ct e d port for th e pack e t upon which th e pack e t is e xp e ct e d to b e 

r e c e iv e d at which of the plurality of possible ports the packet would be expected 
to have been received based, at least in part, on the assoicated relative weights of 
each of the plurality of possible ports ; 

determining at which an actual port for the packet upon which th e pack e t is was actually 
received; 

comparing the actual port to the expected port; and 

providing spurious packet handling in response to wh e n the actual port dees not 
corresponding to the expected port. 

Claim 2 (Cancelled) 

Claim 3 (Original): The method of claim 1 wherein spurious packet handling includes 
discarding the packet. 

Claim 4 (Original): The method of claim 1 wherein spurious packet handling includes 
generating an alert. 

Claim 5 (Original): The method of claim 1 wherein the packet comprises an Internet Protocol 
packet. 

Claim 6 (Currently amended): The method of claim 1 wherein d e t e rmining tho expect e d port for 
the packet calculating the plurality of possible ports furth e r comprises: 

determining a source network address for the packet; and 
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calculating an expected path paths for the packet according to routing trees of switches in 
the network, wherein an e nding endings of the expected path-4s- paths are the 
e xp e ct e d port possible ports . 

Claim 7 (Currently amended): The method of claim 1 wherein determining an expected port for 
the packet furth e r comprises: 

generating a table, the table associating each one of a plurality of possible source network 



applying the table to determine singl e port associat e d with th e sourc e n e twork addr e ss, 
th e singl e port b e ing the expected port. 

Claim 8 (Currently amended): A system for detecting spurious network traffic comprising: 
receiving means for receiving a packet; 

ma pping means for calculating a plurality of possible ports from which the packet is 
expected to be received using a source network address of the packet, wherein 
each one of the plurality of possible ports has associated therewith a weight, the 
weight relating to a likelihood that the packet is received from the one of the 
plurality of possible ports; 

first determining means for determining an expected port for the packet based on relative 
weights of the possible ports ; 

second determining means for determining an actual port for the packet; 

comparing means for comparing the expected port and the actual port; and 

handling means for providing spurious packet handling upon determining that the actual 
port does not correspond to the expected port. 

Claim 9 (Cancelled) 




d e t e rmining a sourc e n e twork addr e ss for th e pack e t ; and 
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Claim 10 (Currently amended): A switch for use in an internetwork, the switch comprising: 

a plurality of ports, each port connected in a communicating relationship with at least one 
of a connected switch and a network; 

a routing database, the routing database containing information relating to the 
internetwork; and 

a processor, the processor configured to compare a first port of the plurality of ports 
through which a packet is received to a second port of the plurality of ports 
through which the packet is expected to be received, the processor further 
configured to provide spurious packet handling upon determining that the first 
port is different from the second port, and configured to generate an expected port 
table, the expected port table mapping each of a plurality of possible source 
network addresses to a plurality of possible ports of the switch, whereby a 
plurality of possible second ports are calculated by using a source network 
address of the packet, wherein each one of the plurality of possible second ports 
has associated therewith a weight the weight relating to a likelihood that the 
packet is received from the one of the plurality of possible second ports. 

Claim 1 1 (Original): The switch of claim 10 wherein the routing database includes a routing tree 
for each one of a plurality of connected switches. 

Claim 12. (Original): The switch of claim 10 wherein the routing database includes a plurality of 
link state update packets and a plurality of routing update packets. 

Claim 13 (Original) The switch of claim 10 wherein the second port is calculated by examining 
one or more routing trees stored in the routing database. 

Claim 14 (Previously presented) The switch of claim 10 wherein the second port is calculated by 
examining a source network address of the packet. 

Claims 15-17 (Cancelled) 
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Claim 18 (Original): The switch of claim 10 wherein the spurious network traffic handling 
includes discarding the packet. 

Claim 19 (Original): The switch of claim 10 wherein the spurious network traffic handling 
includes generating an alert. 

Claim 20 (Currently amended) An internetwork comprising a plurality of switches, each of the 
switches comprising: 

a plurality of ports, each port connected in a communicating relationship with at least one 
of a connected switch and a network; 

a routing database, the routing database containing information relating to the 
internetwork; and 

a processor, the processor configured to compare a first port of the plurality of ports 
through which a packet is received to a second port of the plurality of ports 
through which the packet is expected to be received, the processor further 
configured to provide spurious packet handling upon determining that the first 
port is different from the second port, and configured to generate an expected port 
table, the expected port table mapping each of a plurality of possible source 
network addresses to a plurality of possible ports of the switch, whereby a 
plurality of possible second ports are calculated by using a source network 
address of the packet, wherein each one of the plurality of possible second ports 
has associated therewith a weight, the weight relating to a likelihood that the 
packet is received from the one of the plurality of possible second ports: 

whereby spurious network traffic within the internetwork is detected. 
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